All of the details are the same, but they replace the links or attachments with phishing content. They figure most people will recognize the email but not look carefully at the changes.